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Abstract — Advances in sensing and communication capabilities 
as well as power industry deregulation are driving the need 
for distributed state estimation at the regional transmission 
organizations (RTOs). This leads to a new competitive privacy 
problem amongst the RTOs since there is a tension between 
sharing data to ensure network reliability (utility/benefit to all 
RTOs) and withholding data for profitability and privacy reasons. 
The resulting tradeoff between utility, quantified via fidelity of 
its state estimate at each RTO, and privacy, quantified via the 
leakage of the state of one RTO at other RTOs, is captured 
precisely using a lossy source coding problem formulation for a 
two RTO network. For a two-RTO model, it is shown that the set 
of all feasible utility-privacy pairs can be achieved via a single 
round of communication when each RTO communicates taking 
into account the correlation between the measured data at both 
RTOs. The lossy source coding problem and solution developed 
here is also of independent interest. 

I. Introduction 

The electric power industry is undergoing profound changes 
as greater emphasis is placed on the importance of a smarter 
grid that supports sustainable energy utilization. Technically, 
enabled by advances in sensing, communication, and ac- 
tuation, power system estimation and control are likely to 
involve many more fast information gathering and processing 
devices (e.g. Phasor Measurement Units) [1]. Economically, 
the deregulation of the electricity industry has led to the 
creation of many regional transmission organizations (RTOs) 
within a large interconnected power system [2] (see Fig. Q]). 
Both technical and economic drivers suggest the need for more 
distributed estimation and control in power system operations. 

Distributed Cooperation: While the distributed state estima- 
tion problem has been investigated for well over two decades, 
the focus to date has been on two-tier hierarchical models 
[3] in which each local control center (e.g., RTO) estimates 
independently without sharing any information amongst its 
neighbors, and at a higher level, a central coordinator receives 
the estimation results from the individual areas and coordinates 
them to obtain a system-wide solution. However, such an 
hierarchical approach does not scale with increasing measure- 
ment rates due to communication and reliability challenges 
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Fig. 1. Mutiple RTOs (subnets) connected via the transmission network. 



inherent in systems with one coordination center. Furthermore, 
the interconnectedness of the RTOs makes the problem of 
wide area monitoring and control (e.g. for the entire Eastern 
United States interconnection) important and immediate. This 
requirement of sharing the entire system state amongst all the 
RTOs is driving the need for a fully distributed approach to 
state estimation wherein the local control centers interactively 
estimate the system state as a whole. 

There are several challenges that arise in the context of 
a fully distributed state estimation approach. We address a 
specific problem of collaboration and competition by introduc- 
ing a framework that precisely quantifies the tradeoff between 
the utility (benefit) of collaboration and the resulting privacy 
leakage. 

Competitive Privacy: The problem of end-user privacy has 
begun receiving attention with the deployment of smart meters 
to monitor and finely manage user power consumption [4]-[9]. 
In contrast, a new competitive privacy problem arises at the 
level of the RTOs due to the conflict between sharing data 
for distributed estimation and withholding data for economic 
(competitive) and end-user privacy reasons, i.e., there is a 
tradeoff between sharing data to ensure network reliability 
(utility/benefit to all RTOs) and withholding data to ensure 



profitability and privacy. 

Competitive privacy has been studied by the database 
community in the context of data integration from multiple 
autonomous sources that do not wish to reveal private sensitive 
business information to one another and yet benefit from 
the combined analysis [10]. However, the solutions proposed 
are unique for databases and do not directly apply to the 
distributed state estimation problem discussed above. An an- 
alytical framework that abstracts the problem of competitive 
privacy via appropriate source models and utility and privacy 
metrics is required and it is this problem that we address in 
this paper. 

Utility vs. Privacy: Utility and privacy are competing goals: 
utility is maximized when the RTOs completely disclose then- 
measurements to each other; however, privacy is minimal for 
this disclosure. On the other hand, not sharing any data guaran- 
tees maximal privacy but achieves zero utility. Thus, ensuring 
privacy requires distorting or perturbing the data which also 
provide utility guarantees. The theory of rate distortion allows 
us to study this tradeoff between privacy and utility using 
appropriate metrics for both constraints; we present such a 
formal framework in this paper for the competitive privacy 
problem. 

Contributions: In this paper, we present a linear measure- 
ment model for the grid at the level of the RTOs that takes 
into account the interconnections amongst them. Viewing the 
power system state at each RTO as an information source, we 
model the measurements at each RTO as a linear combination 
of all the sources. The competitive privacy problem formulated 
thus leads to a new distributed lossy source coding problem 
wherein each RTO shares (encodes) a perturbed function of 
its measurements, and over a finite number of such commu- 
nication rounds, estimates its state subject to two constraints: 
a) each RTO must be able to decode its own measurements to 
a desired fidelity, and b) at each RTO, the privacy leakage of 
the measurements shared by the other RTOs must be bounded. 

Distributed source coding has received much attention re- 
cently with a growing interest in sensor networks. How- 
ever, with a few exceptions, most distributed source coding 
problems remain open. One such exception is the quadratic 
Gaussian CEO problem in which a source is observed noisily 
by multiple sensors, each of which uses a finite-rate link to 
communicate it to a single receiver which in turn combines 
these messages to reconstruct the source to a desired level of 
fidelity [11]. The problem presented here further generalizes 
such a setting in the following ways: a) there are multiple 
sources, b) each sensor (here RTO) is now both an encoder 
and a decoder, i.e., there are multiple encoders and decoders, 
and c) there are fidelity requirements at each RTO for its 
own measurements and privacy requirements vis-a-vis other 
measurements. 

Having modeled the general problem, we focus on a two- 
source setting that captures the distributed estimation problem 
for two large RTOs. Using distortion as a metric for utility 
and mutual information as a metric for privacy leakage, we 
demonstrate that a single-shot rate-distortion code at each RTO 



that is cognizant of the side information (measurement vector) 
at the other RTO achieves the set of all feasible utility-privacy 
operating points. 

The paper is organized as follows: in Section|IIl we develop 
the model and present abstract metrics for utility and privacy. 
In Section [nil we present our main results. We conclude in 
Section |IV] 

II. Model and Metrics 

A. Model 

Let M denote the total number of RTOs and let X m 
denote the power system state variable at the m th RTO, 
to = 1,2,..., M. Assuming linearized system dynamics, the 
general measurement model at the k th terminal at a sampling 
time instant is given by 

M 

Y m =J2 HmjXj + Z rn , m = 1, 2, . . . , M, (1) 

i=i 

where X m ~ Af (0, 1), for all to, are assumed to be mutually 
independent, and where H m j denotes the Jacobian modeling 
the linearized dynamics between the j th state and the measure- 
ment at the m th RTO. The observation noise at the m th RTO 
Z m ~ A/" (0, cr^j) is assumed to be independent of X m , for all 
to. We assume that the H m j are fixed and known at all RTOs 
for the duration of communications; furthermore, we also 
assume that the statistics of the noise, the measurements, and 
the states are known at all the RTOs. In this paper, we focus 
on case of M = 2, i.e., we are interested in the distributed 
estimation problem between two (typically large) adjacent 
RTOs. Finally, we set H\ i = H2.2 = 1, Hi 2 = a £ (0, 00), 
and H 2 ,i =13 e (0,oo). 

We assume that the to*' 1 RTO observes a sequence of n 
measurements Y£ — \Xm,i ^m,2 • ■ • Y m , n ], for all to, over a 
window of time prior to communications. The communication 
protocol is shown in Fig.|2]for M — 2. In each communication 
round, the two RTOs take turns such that each RTO encodes 
(quantizes) its measurements taking into account the fact the 
other RTO has correlated side information (the correlations 
come from the measurement vectors at each RTO being 
functions of the state variables at both RTOs). We assume 
a total of K such communication rounds before RTO to 
estimates X^, m = 1, 2, using the entire sequence of public 
communications and its own measurements. 

B. Metrics 

Utility: The motivation for cooperation at each RTO is to 
obtain a good estimate of its own system state. Thus, for 
our continuous Gaussian distributed state model, a reasonable 
metric for utility at the m th RTO is the mean square error 
D m of the original and the estimated state sequences X™ and 
X^, respectively. 

Privacy: The measurements at each RTO in conjunction 
with the quantized data from the other RTO while enabling es- 
timation of its own state can also potentially leak information 
about the state at the other RTO. We capture this information 
leakage via the mutual information. 
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RTO 2 Enc./Dec. 
Fig. 2. Communication protocol for two RTOs. 



C. Communication Protocol 

A coding scheme for the network involves an encoder- 
decoder pair at each RTO over K communication rounds 
such that some desired utility and privacy values are achieved. 
Formally, an (n, K, Mi, M 2 , D±, D2, L±, L 2 ) code for this 
network results from a if-round protocol in which RTO m, 
= 1, 2, uses the encoding functions {f m ,k} for the k th round 
and a decoding function F m at the end of the K rounds. In 
round k, the encoder at RTO m maps its measurements and 
the messages received until then from the other RTO to an 
index set J^ n where 

J* ={l,2,...,J*}, k = l,2,...K, m = l,2, (2) 

is the index set at the m th RTO for mapping the quantized 
sequence in the k th protocol round via the encoder f m defined 

as 

fm : >Xn x <^m X ■ • ■ X 3 m *J m , fc = 1, 2, . . . K, m — 1, 2, 

(3) 

such that at the end of the K rounds, the decoding function F m 
at the m th RTO is a mapping from the space of measurements 
and received messages to that of the reconstructed sequence 
denoted as 



•Xn x Jm x ... x J m — > X™, m — 1, 2 



(4) 



Let J m = {J m },_ x , denote the set of all indices communi- 
cated by the m th RTO, m = 1, 2, such that Mi and M% denote 
the size of J\ and J2, respectively. The expected distortion 
D m at the m th RTO is given by 



D,, 



-E 



n f 
i=l K 



x„ 



1,2, (5) 



and the privacy leakage, L 1 , about state 1 at RTO 2 is given 
by 



L\ — —I (X"; Ji, J 2 , Y 2 n ) , 
n 



(6) 



and the privacy leakage, L%, about state 2 at RTO 1 is given 
by 

L 2 = -I(X; ; J 1 ,J 2 ,Y 1 "). (7) 
n 

The communication rate of the rn th RTO is denoted by 

R m = n^ 1 log 2 M m , m = 1, 2. (8) 

Definition 1: The utility -privacy tradeoff region T is the set 
of all (D\, D2, Li, L2) for which there exists a coding scheme 
given by ©-(HJi with parameters (n, ii', Mi , M2 , D\ + e, D2 + 
e, L\ + e, L2 + e) for n sufficiently large such that e — > as 

III. Main Results 

The coding and communication protocol described in the 
previous section is constrained only by the fidelity require- 
ments of the desired state estimate at each RTO and the privacy 
leakage of the state at the other RTO. Furthermore, from 
Definition [TJ we note that the utility-privacy tradeoff region 
T is also dependent on size of the encoding indices Mi and 
M2 , i.e., for every (D\, D2,L%, L2) G T, there can be several 
achievable coding schemes each corresponding to some com- 
munication rate pair {Ri,Rz). Thus, it suffices to determine 
the set of all rate-distortion-leakage (R\, R2, Di, D2, L\, L2) 
tuples to determine the utility-privacy tradeoff region. 

A. Rate-Distortion-Leakage (RDL) Tradeoff 

Recall that Y\ = X x + aX 2 + Ni and Y 2 = PX 1 +X 2 +N 2 , 
where X m ~ A/"(0, l),m = 1,2, and N m ~ Af(0, cr^), m = 
1,2, are all mutually independent. We first state the range of 
allowable distortion pairs (Di,D2) as 
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(9a) 
(9b) 

(10a) 

(11a) 
(lib) 
(11c) 



The lower bounds -D m in,i and -D m i n ,2 on D\ and D2 in (O, 
respectively, are obtained by considering an enhanced system, 
in which both observations {Y\,Y 2 ) can be jointly used for 
estimating X\ and X2. For such a system, the minimum 
mean square error (MMSE) estimator minimizes the quadratic 
distortion in ©. Therefore, £> m i n .i and £> m i n .2 are given by 



A„i„,i =E[var(X 1 \Y 1 ,Y 2 )} 
D min!2 =E[var(X 2 \Y 1) Y 2 )} 



(12) 
(13) 



where for two random variables A and B, var (A\B) is the 
conditional variance of A conditioned on B. On the other 
hand, Z? max ,i and -D ma x,2 correspond to the fidelity criterion 
achievable using only the locally available measurements at 
each RTO such that 

D max , 1 =E[var(X 1 \Y 1 )] (14) 
D max , 2 = E[var(X 2 \Y 2 )]. (15) 

The range of feasible leakage values L\ and L 2 are 

Li£[I{Xi;Y 2 ),I(Xi;Yi,Y 2 )}, and (16) 
L 2 e[I{X 2 ;Y 1 ),I(X 2 ;Y 1 ,Y 2 )}. (17) 

The lower bound on Li, i.e., I(Xi;Y 2 ) is guaranteed only 
for the case in which there is no public communication. This 
scenario can arise if D\ and D 2 can be achieved at each 
RTO with its own measurements (corresponding to D m ax,i 
and D max2 , respectively). At the other extreme, the maxi- 
mum value of leakage L\ can go up to I(Xi;Yi,Y 2 ). This 
corresponds to an infinite rate transmission from RTO 1 to 
RTO 2 to satisfy the distortion requirement D 2 — D min2 . A 
similar upper bounding argument holds for L 2 . 

Finally, we exploit the Gaussian nature of the system 
variables to write 



If Di > Djoaxi, then 



E[Xi\Yi,Y 2 }=kiYi+k 2 Y 2 
E[X 2 \Y 1 ,Y 2 ]=l 1 Y 1 +l 2 Y 2 



(18a) 
(18b) 



L 2 



0, and 
1 



where Dmin^mi -^max.m 



log (14/(^1 -a)), 



(26) 
(27) 
are 



V m , E, and l m , k m , m = 1,2, 
defined in ©, (fTUal i. CO), and (O. 

Remark 3: Theorem [2] shows that the optimal rate- 
distortion-leakage tradeoff for the Gaussian case admits a 
decoupling with respect to the distortion pair (Di,D 2 ). By 
decoupling, we mean that the leakage of source Xi and the 
transmission rate of RTO 1 depends solely on the distortion 
D 2 desired by RTO 2. Similarly, the leakage of X 2 and the 
transmission rate of RTO 2 depends solely on the distortion 
Di desired by RTO 1. The reason for this decoupling can 
be attributed to the no rate-loss property of jointly Gaussian 
sources, which can be described as follows: if RTO 2 is 
interested in reconstructing X 2 at a distortion D 2 , then the 
minimal rate of transmission required by RTO 1 remains 
unchanged even if the source Y 2 is available at RTO 1. 

We briefly sketch the proof below; we first derive lower 
bounds on the rate and privacy leakage and present a coding 
scheme that achieves them. 

Proof: Lower bound on Ri,R 2 : Recall that we write Ji 
to denote the message from RTO 1 over all K communication 
rounds. Given a distortion pair (Di,D 2 ), we prove the lower 
bound on Ri as follows: 



where 
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h 
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Vi V 2 -E 2 ' 



m-E 

k 2 = ^, and 



h = 



ViV 2 ~E 2 '' 
Vi - aE 



(19a) 
(19b) 



ViV 2 -E 2 ' 

Using these results, we now summarize the rate-distortion- 
leakage tradeoff for the problem under consideration in the 
following theorem. 

Theorem 2: The rate-distortion-leakage tradeoff 
(Ri, R 2 , Di, D 2 , Li, L 2 ) is given as follows. 

If D 2 £ [D min , 2 , D maXi2 ], then 



2 H^0D 2 -Ani„, 2 ) ' 



Li 



Ij ( l\ 

2 ° g \llD minA + kl(D 2 - Anin, 2 ) 



If D 2 > D max ,2, then 



Ri = 0, and 

Li = \ log (V 2 /(V 2 -/?)). 
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(20) 
(21) 

(22) 
(23) 

(24) 
(25) 



nRi = H{Ji) 

>I{Y?-Ji\Y 2 n ) 



> nh(Yi\Y 2 ) - ^2 h(Yi t \Ji,Y 2 n ) 



(28a) 
(28b) 

(28c) 



>nh(Yi\Y 2 ) 



>nh{Yi\Y 2 ) 



^2 

t=i 



log(27reVar(y lt |Ji,y 2 ™)) (28d) 



-log ( 27re^Var(y lt |J 1 ,y 2 ")/r 



>n/i(yi|y 2 )--log (27re(^ 2 
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)/H) 



-\og{27re{ViV 2 



E 2 )/V 2 ) 



log (27re(D 2 - Aom.a)/!?) 
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2 log 



{V1V2 - E 2 )l\ 
V 2 {D 2 - D min<2 ) 



(28e) 
(28f) 

(28g) 
(28h) 



where the inequalities in (128b follow from the chain rule, the 
fact that conditioning does not increase entropy, the fact that 
Gaussian distribution maximizes the differential entropy for 
a given variance, and the concavity of the log function. The 
variance of Yu conditioned on J\ and Y 2 n can be computed 
using ( TT8l and ( fT9b and is omitted due to space limitations. A 
lower bound on R 2 can be obtained similarly. Therefore, Ri 
and R 2 can be lower bounded by the expressions in d20l > and 
respectively. 



Lower bounds on (Li,L 2 ) : Given an arbitrary code that 
achieves a certain distortion pair (Di,D 2 ), we derive lower 
bound on the leakages for both RTOs as follows: 



Li > ^I(X[ l ; Ji,J 2 ,Y 2 n ) 


(29a) 




- —h(X?\ h U Y?\ 
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(29b) 
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-h(X?\Ji,Y 2 n ) 


(29c) 


> HXx) 


-h(X?\Ji,Y 2 n ) 
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> h(Xi) 
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(29e) 


> h{X x ) 
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--^-log(27re Var(X lt |J 1; F 2 ")) 
n t=i z 


(29f) 


> h{X x ) 


- ilog (^re^ Var^tlJi.lT)! 


| (29g) 


> KXx) 


- - log (27re(D min ,i + kj{D 2 - D min 


,2)//?)) 



(29h) 

where the inequalities in d29l follow from the chain rule, the 
fact that conditioning does not increase entropy, the fact that 
Gaussian distribution maximizes the differential entropy for a 
given variance, and the concavity of the log function. A lower 
bound on L 2 can be obtained similarly. Simplifying further, 
we can lower bound L\ and L 2 with the expressions in (I2TI 1 
and d25b , respectively. 

Upper bounds on (Ri,R 2 ) and [L\,L 2 ) via an achievable 
coding scheme: The lower bounds derived above can be 
achieved using the Wyner-Ziv source coding scheme with de- 
coder side information [12] at each RTO. We briefly describe 
the encoding scheme at RTO 1 and the resulting decoding at 
RTO 2; the coding scheme for RTO 2 follows analogously. The 
encoding is such that RTO 1 generates a set of M\ sequences 
U^iji), h = 1,2,..., M u where M x = 2 n{I{Ul ' Y ^ +t \ 
However, to exploit the fact that RTO 2 has correlated mea- 
surements, RTO 1 further bins its Mi sequences into S\ bins 
chosen at random where Si = 2 n{ - I{ - Ul ^' I ^ Y ^ +t \ Upon 
observing a measurement sequence y", the encoder at RTO 1 
searches for a U x (ji) sequence such that y™ an d u i (ji) arc 
jointly typical (as defined in [13, Chap. 10]) where the choice 
of Mi ensures that there exists at least one such j x . Using 
the fact that RTO 2 has its own measurements Y 2 as side 
information, the encoder at RTO 1 sends only b(ji) where 
b (ji) is the bin index of the it™ (ji) sequence. 

For Gaussian distributed state and measurements, the se- 
quence U x is chosen such that the 'test channel' from Ui 
to Yi yields Y x — Ui + Qi, where Qi is a Gaussian random 
variable, independent of Ui, with variance Si chosen to satisfy 
© and 

Xi =E[X 1 \U 2 ,Yi}. (30) 

Using <(5j and ( 13 OK we see that the achievable distortion 
Di is simply the conditional variance of X\ given (Yi,U 2 ). 



From (19 at . since -D m i n .i is the conditional variance of X\ 
given (Yi, Y 2 ), we have that D\ is given by the expression in 
( |9at with V 2 replaced by V 2 + S 2 ; thus, the variance of the 
quantization noise S2 is a function of D\. One can similarly 
obtain D 2 from d9bl by replacing V\ by Vi + Si and observe 
that Si depends on D 2 but not D\. The resulting rate Ri 
is simply the Wyner-Ziv rate Ryvz between encoder 1 and 
decoder 2 with side information Y 2 and is given by 



Ri=Rwz=I(Y 1 ;Ui\Y 2 ) 
= 1 / var(Yi\Y 2 ) 
2 ° g \var(Yi\UiY 2 ) 



(31) 
(32) 



Writing S 2 in terms of D 2 and D m [ n 2 and simplifying the 
expressions, one can verify that R x simplifies to the expression 
in Theorem ( l20b . Since f7™ is a function of (Ji,Y 2 n ), the 
expression for L x defined in (0 simplifies to I {Xi;U{Y 2 ) 
which in turn further simplifies to the expression in ( f2TT >. 
Finally, one can similarly show that Wyner-Ziv encoding is 
rate and leakage optimal for RTO 2. ■ 

Remark 4: The leakage of Xi at RTO 2 depends only on 
the desired distortion of X 2 and vice-versa, or alternatively, 
the feasibility of the distortion desired by RTO 2 depends 
on the leakage permissible by RTO 1. Thus, cooperation to 
achieve a desired fidelity at the other RTO inevitably results 
in a proportional privacy leakage. 

Remark 5: Practical implementations of the Wyner-Ziv 
coding schemes have been well studied and can be applied 
to the problem at hand. 

B. Illustration 

We illustrate our results for a = 1, /3 = 8, erf = 0.05, and 
cr| = 1. The parameters so chosen demonstrate the need for 
communication between the RTOs since at each RTO, there is 
interference from the measurements at the other RTO as well 
as noise. In Fig. [3] Ri and L\ are plotted as functions of 
D 2 while in Fig. |U the effect of changing the distortion Di 
from its minimum to its maximum value on the rate R 2 and 
privacy leakage L 2 for RTO 2 are shown. The asymmetry in 
the interference and noise levels is captured in the two plots. 

IV. Concluding Remarks 

In this paper, we have formalized the conflicting objectives 
of estimation accuracy and competitive privacy in smart-grid 
operations in terms of a class of information theoretic multi- 
terminal source coding problems. For a scalar Gaussian source 
model with two RTOs, we have completely characterized the 
set of optimal privacy-utility tuples via the rate-distortion- 
leakage tradeoff for a mean-squared estimation criterion. We 
have shown that the RDL tradeoff at each RTO depends 
only on the fidelity requirement at the other RTO with a 
higher fidelity requirement leading to a higher rate and higher 
leakage and vice-versa. While the results here also extend to 
vector Gaussian sources and a mean-square fidelity criterion, 
we intend to investigate the RDL trade-off for general non- 
Gaussian source models and multiple RTOs in a forthcoming 
paper. 
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Finally, we comment on some practical implementation 
issues associated with the proposed distributed formulation. 
While the optimal encoding strategies are necessarily block 
based, in practice it may not be feasible to accumulate the 
incoming data for long at each RTO and subsequently encode 
the entire block. A potential research direction would be 
the investigation of heuristic real-time encoding schemes that 
yield close to optimal performance with much less encoding 
complexity. Finally, a practical approach for the distributed 
and decentralized information broadcast in such multi-agent 
networks is via gossip protocols (see, for example, [14]). 
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